FeehiCMS index.php createBanner unrestricted upload

Vulnerability

Description

CVE-2024-8295 is a critical vulnerability in FeehiCMS up to version 2.1.1, reported as publicly disclosed. The issue resides in the /admin/index.php?r=banner%2Fbanner-create endpoint, specifically within the createBanner function. By manipulating the BannerForm[img] argument, an attacker can upload arbitrary files without restriction, enabling code execution on the server [1].

Exploitation

The attack is initiated remotely and does not require authentication, as the vulnerable endpoint is accessible to any user. The lack of validation on the uploaded file type or content allows an attacker to upload a PHP web shell or other malicious files. Since FeehiCMS is based on the Yii2 framework and runs on PHP, the uploaded file can be executed directly, leading to full compromise [2]. The exploit has been publicly released, increasing the risk of widespread attacks.

Impact

An attacker can upload arbitrary files, including PHP shells, to the web server. This can lead to remote code execution, data theft, privilege escalation, and full server takeover. The vulnerability is classified as critical due to the minimal attack complexity and severe impact [1].

Mitigation

As of the publication date, the vendor has not responded nor released a patch. Users are advised to immediately restrict access to the admin panel, implement file upload validation via web server configuration, and consider migrating to an alternative CMS if no update becomes available. The vulnerability's public disclosure and lack of vendor response raise significant risk [1][2].

Note: The vendor's GitHub repository shows no activity addressing this issue [2].